WirelessHART is the wireless extension of the HART protocol, standardized as IEC 62591. It was introduced by the HART Communication Foundation (now part of FieldComm Group) in September 2007 and ratified by the IEC, with the current edition published as IEC 62591:2016. The standard targets process industries that need reliable wireless field communication — refineries, chemical plants, power generation, metallurgy — where running new cable is too costly, too disruptive, or simply not possible.
A WirelessHART network supports multi-vendor devices, classified into five categories: field devices, handheld devices, adapters, gateways, and access points. The network manager and security manager are software functions that govern the network; they typically run on the gateway rather than on dedicated hardware.
Protocol Stack
WirelessHART follows the OSI reference model and is structured in five layers: physical, data link, network, transport, and application. The application layer remains fully compatible with wired HART, so existing HART commands, device descriptions (DDs), and configuration tools continue to work over the wireless network.
Physical Layer
The physical layer is based on IEEE 802.15.4-2006, operating in the 2.4 GHz ISM band (2400–2483.5 MHz) with direct sequence spread spectrum (DSSS). The raw data rate is 250 kbit/s. The band is divided into 16 channels, numbered 11 to 26, with 5 MHz spacing between adjacent channels.
Data Link Layer
This is where WirelessHART differs most from a generic 802.15.4 network. The data link layer uses TDMA (time division multiple access) with a strictly defined 10 ms timeslot. Every transmission is scheduled in advance, which eliminates collisions and makes latency deterministic — a hard requirement for process control.
The data link layer also implements channel hopping. Each transmission can use a different channel from the allowed list, which reduces interference from coexisting 2.4 GHz traffic such as Wi-Fi, Bluetooth, and ZigBee.
Network and Transport Layers
Together they handle routing, end-to-end reliability, and session management across the mesh. Every WirelessHART device is required to forward packets for other devices, so the network self-organizes into a mesh and self-heals when nodes drop out or links degrade. The network manager assigns routes, schedules timeslots, and monitors network health.
Application Layer
Command-based and identical to wired HART. A host application that already speaks HART can talk to wireless field devices without changes to its command logic — which is the main reason WirelessHART has been adopted in brownfield plants.
Security Model
Security is built into the data link and network layers. It is not an optional add-on.
The MAC layer uses a CRC for error detection plus a Message Integrity Code (MIC) for hop-to-hop integrity. The MIC is computed using AES-128 in CCM mode (Counter with CBC-MAC). The network layer adds end-to-end encryption and integrity, also based on AES-128.
WirelessHART defines four key types:
- Public key — used to generate the MAC-layer MIC when a device does not yet hold the network key (for example, while listening for join advertisements).
- Network key — shared by all devices in the network and used for the MAC-layer MIC during normal operation.
- Join key — unique to each device. The network manager uses it to authenticate a new device when it requests to join the network.
- Session key — created by the network manager for each end-to-end connection between two devices, used for payload encryption and integrity. Session keys are further split into unicast and broadcast variants.
The join key is provisioned out of band — typically with a HART handheld or commissioning tool — before the device is powered on at site. After joining, the device receives the network and session keys over the air, encrypted with the join key.
Where WirelessHART Fits in a Real Plant
In a plant with an existing HART installation, replacing wired instruments to add wireless coverage is rarely justified. A wireless adapter — such as the Microcyber A1110, compliant with HART 7.6 — lets a wired HART transmitter join a WirelessHART network without removing the original instrument. The adapter taps into the 4–20 mA loop or runs on its own battery, and the host then sees the same HART data over the mesh.
For new measurement points where running cable is expensive, a wireless temperature transmitter such as the NCS-TT105W reports process variables to the gateway at a configurable update period.
For OEMs developing their own WirelessHART instruments, the M1100S embedded module integrates the full protocol stack and exposes a serial interface to the host MCU. It removes the need to develop the radio firmware, the TDMA scheduler, and the security stack in-house.
At the host side, the G1100 WirelessHART gateway manages network formation and device join, runs the network manager, and exposes the field data to control systems through Modbus TCP, Modbus RTU, OPC, or HART-IP.